Key points
- ZKEACMS versions up to 4.4 contain a hard-coded signing key that enables JWT token forgery.
- The vulnerability allows attackers to bypass authentication and access administrative API endpoints.
- Exploitation permits modification of articles and products, as well as reading private form submissions.
SeriaWei ZKEACMS through version 4.4 is affected by CVE-2026-111633, a high-severity authentication bypass. No official patch or fix has been confirmed by the vendor for this specific vulnerability. Security teams must verify if their installations fall within the affected version range and assess exposure immediately, as the flaw allows complete circumvention of standard login procedures.
In plain English
The software relies on a security token system called JWT to verify user identities. The code contains a secret signing key that is hard-coded and known to attackers. Because this key is public, anyone can create a fake token that the system accepts as genuine. Attackers can set their identity to "admin" within these forged tokens.
The background
According to the National Vulnerability Database, the issue stems from weaknesses classified as CWE-321. The flaw exists in a file named JwtBearerDefaults.cs. Attackers use this to sign tokens that call protected API endpoints. They do not need to steal a password or guess credentials. The system trusts the forged token because it matches the internal, exposed signature key.
What changes now
Attackers can modify stored articles and product listings without authorization. They can also read data submitted through forms. This access is not limited to viewing public content. The ability to write changes means data integrity is compromised. Since the authentication mechanism is bypassed, standard user permissions are ignored entirely by the forged administrative tokens.
Who needs to act first
Teams should prioritize systems exposed to the public internet. Identify which servers run affected ZKEACMS versions. Isolate critical instances from untrusted networks if possible. Test any temporary mitigation measures in a staging environment before applying them to production. Back up all configuration files and databases before making changes. Monitor logs for unauthorized API calls that might indicate active exploitation.
What to do and how to stay safe: ZKEACMS
- Check your current ZKEACMS version and compare it against the affected list ending at version 4.4.
- Review server logs for suspicious REST API activity or unexpected token generation from unknown sources.
- Restrict access to the application endpoints using network-level controls until a vendor update is available.
- Ensure all configuration files are backed up before attempting any manual code changes or workarounds.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the specific CVE ID for this ZKEACMS vulnerability?
The vulnerability is identified as CVE-2026-111633 in the National Vulnerability Database records.
Which versions of ZKEACMS are affected by this flaw?
All versions of SeriaWei ZKEACMS up to and including version 4.4 are affected.
What can an attacker do with this vulnerability?
Attackers can forge admin tokens to modify articles and products, and read form submissions via API endpoints.
